Payment integrations · Fintech platforms · Transaction systems
Theia Software is a boutique engineering consultancy for the systems money moves through: gateway and PSP integrations, webhook pipelines, reconciliation, refunds and merchant back office tooling.
Senior .NET and ASP.NET Core engineering from a small team whose production experience includes card tokenization, settlement flows and high volume retail checkout inside PCI DSS scoped environments.
Failure handling and audit trail at every hop.
Who we work with
Product teams that need senior backend capacity on the paths money runs through, without widening the scope their compliance programme has to cover.
Operators who need checkout, gateway and back office integrations that stay correct through retries, partial failures, refunds and chargebacks.
Engineering groups that want a payments specialist working beside their own developers on a defined, time boxed scope.
What we solve
Each entry below is a problem we have been brought in to fix, the work it takes, and the state your system ends up in.
We instrument the integration end to end: structured logging on every hop, webhook delivery tracking, dead letter queues for what cannot be processed, and alerting tied to the states that actually matter.
Failed and stuck transactions surface as operational events, not as support tickets.
Idempotency keys at the API boundary, request deduplication, an outbox for outbound calls, and retry policies with backoff and explicit timeout budgets.
The same request can be safely replayed after a timeout or a network failure.
Reconciliation jobs that match internal transaction records against provider settlement and report files, with an exception queue for everything that does not line up.
A daily position you can defend, and a short list of real exceptions instead of a spreadsheet hunt.
Integration with the new provider behind an internal abstraction, sandbox to production rollout, parallel running against the old path, and a cutover plan that includes a way back.
A migration you can stage, verify and reverse, instead of attempting it in one night.
We work as engineers inside PCI DSS scoped environments: OWASP Top 10 oriented code review, SDLC documentation such as impact analysis and backout plans, card data discovery across data stores, and key handling through KMS and least privilege IAM.
Evidence produced during normal delivery, in the form your assessor asks for.
Merchant and back office interfaces: transaction search, settlement views, refund and dispute handling, exports and role based access, built in React and TypeScript on top of your APIs.
Support and finance answer their own questions without a developer in the loop.
Ways to work with us
Entry level engagement
A fixed scope, fixed fee review of one payment integration or transaction flow. We read the code and the configuration, map the failure paths, and hand you a written assessment ranked by risk. It is the fastest way to find out whether your integration behaves the way you think it does, with no obligation to continue.
Request the reviewYou receive a findings document ranked by risk, a prioritised remediation plan, and a ninety minute walkthrough with the engineers who did the review. If you continue with a build engagement, the review fee is credited against it.
Scoped delivery of a new payment integration, a provider migration, or the reliability work identified in the review. We own the integration layer and hand it over tested and documented.
A senior engineer or a small team working inside your sprints, your repository and your review process for a defined period, so the knowledge stays in your team.
Payments is our specialism, not our limit. We also build and maintain general purpose backends, internal platforms and web applications on the same .NET and React stack.
Selected work
Client names and commercial figures stay confidential. What follows is the engineering problem, the approach taken, and the resulting state.
Card data had to be tokenized, stored encrypted and settled across several isolated databases, inside a scope an assessor would review, while the platform kept shipping features.
Thread safe background services and microservices on AWS with Aurora MySQL, EKS, KMS and IAM. Card tokenization with encrypted storage, token references and settlement flows across isolated stores. Asynchronous processing on RabbitMQ pipelines, delivered through GitLab CI/CD. Audit preparation handled inside the work: OWASP Top 10 code review evidence, SDLC impact analysis and backout documentation, and card data discovery across OpenSearch and Aurora.
Payment operations ran on documented, instrumented services, and the evidence an assessor asks for was produced during delivery rather than reconstructed afterwards.
Checkout services handling tens of thousands of transactions a day, maintained by a distributed cross functional team, where a regression reaches the till.
ASP.NET Core and Entity Framework services with REST APIs between them, PostgreSQL storage, React and TypeScript on the front end, unit and integration tests in xUnit, SonarQube quality gates and Jenkins pipelines running on Rancher.
Features reached production through an automated path where review, tests and static analysis had to pass first.
Rental staff retyped identity cards and driving licences by hand at pickup, which was slow and produced inconsistent data across countries.
A .NET 8 API built from scratch around Azure AI Document Intelligence, with per country field and address normalisation, EF Core and SQL Server persistence, API key authentication, audit logging and Application Insights telemetry.
The rental system calls the API directly and receives structured booking data from a scanned document, instead of relying on manual entry.
A small product needed recurring billing and expense capture without a finance team behind it.
A .NET 8 Web API with a React front end, recurring payment scheduling, OCR receipt ingestion, JWT authentication and document storage on AWS S3.
Recurring charges and receipts run through one service, with documents stored and linked to the transactions they belong to.
How an engagement runs
We go through the integration, the data it touches and the failure history with your team, then agree what is in scope, what is explicitly out, and where the compliance boundary sits.
Integration design on paper first: states, idempotency strategy, retry and timeout budgets, webhook handling, reconciliation rules and audit trail. You approve it before code is written.
Implementation with tests, code review and CI from the first commit, deployed into your cloud account under your controls, with failure paths exercised deliberately and not only the happy path.
Monitoring and alerting wired to the states that matter, runbooks for the failures we know about, documentation your team can maintain, and support for as long as you want us involved.
About Theia Software
Theia Software is a Romanian engineering consultancy built around more than ten years of production .NET work in payments, enterprise retail and transactional systems. Architecture and backend engineering are led in house. Frontend, DevOps, QA and delivery management are covered by long standing senior collaborators, brought into a project when the work calls for them.
That structure is a deliberate choice. Payment work rewards a small number of people who understand the whole path and stay with it, and it punishes handovers between people who each own a fragment.
We work B2B and remote first, with clients in Romania and abroad, in English or Romanian.
We are the engineers who build and harden the software our clients use to do those things, inside the scope their own compliance programme defines. Where a formal assessment is required we work alongside your assessor, we do not replace them.
Questions we are asked
Yes, as engineers. Our team has worked inside PCI DSS scoped payment environments, including card tokenization, encrypted card data storage and audit evidence preparation. We follow the controls your programme defines and work alongside your assessor. We are not a QSA and we do not issue compliance opinions or certificates.
We integrate against documented REST and webhook APIs, which covers most modern gateways, PSPs and acquirers. We do not claim partner or reseller status with any provider. Tell us which provider and which flows you need, and we will tell you plainly how much of it we have done before.
Yes. A large share of our work is embedded: our engineers work in your repository, your sprint cadence and your review process, so the knowledge stays with your team when the engagement ends.
It is a fixed fee engagement running five to ten business days, depending on the size of the integration. The fee depends on scope and is agreed in writing before we start. If you continue with a build engagement afterwards, the review fee is credited against it.
No. Payments and transactional systems are our specialism and where we are most useful, but we also build general purpose backends, internal tools and web applications on the same stack. If a project would be better served by someone else, we will say so.
Describe the integration, the stack and the deadline. You get a reply from an engineer, not a sales pipeline, within one business day.
Contact
The more concrete, the better: the provider you integrate with, the part of the flow that hurts, the stack it runs on, and when it needs to be done.
